Recent Files

Artemis supports parsing macOS recently open files (sfl files). These plist files contain files and directories recently opened by macOS applications

Collection

You have to use the artemis api in order to parse Recent Files data.

Sample API Script

import { recentFilesMacos } from "./artemis-api/mod";

function main() {
    const results = recentFilesMacos();
    console.log(JSON.stringify(results));
}

main();

Output Structure

An array of RecentFiles objects

export interface RecentFiles {
    evidence: string;
    shared_file_type: SharedFileType;
    message: string;
    datetime: string;
    timestamp_desc: string;
    artifact: "Recent Files";
    data_type: "macos:plist:recentfile:entry";
    plist_data_type: PlistDataType;
    [ key: string ]: unknown;
}

export enum SharedFileType {
    FinderFavorite = "Finder Favorite",
    VolumeFavorite = "Volume Favorite",
    UnknownFavorite = "Unknown Favorite",
    ApplicationRecentFiles = "Application Recent File",
    ProjectFavorite = "Tag Favorite",
    RecentApplication = "Recent Application",
    RecentDocuments = "Recent Documents",
}

export enum PlistDataType {
    Bookmark = "Bookmark",
    CodeSign = "Code Signing"
}